The modern geopolitical landscape is defined not only by overt military confrontations on conventional battlefields but also by an intensifying “shadow war” waged across foreign capitals, maritime trade routes, and cyberspace. At the vanguard of this subterranean conflict are Russia’s primary intelligence apparatuses—most notably the GRU (the military intelligence agency’s Main Directorate) and the FSB (the Federal Security Service). In the years following the full-scale invasion of Ukraine, Moscow has drastically escalated its “active measures,” shifting from traditional espionage and covert influence operations to an aggressive campaign of physical sabotage, targeted assassinations, and infrastructural warfare against Western nations.

Understanding the brutal reality of these tactics requires looking past Hollywood tropes of cold war cloak-and-dagger to examine a modern, highly pragmatic, and often reckless ecosystem of state-sponsored mayhem.

The Architecture of the Shadow War: GRU and FSB

To comprehend how Russian intelligence executes operations on foreign soil, one must first recognize the division of labor within Moscow’s security apparatus. While the SVR (Foreign Intelligence Service) handles traditional long-term espionage, diplomatic cover collection, and political influence, the GRU and the FSB have taken the lead in executing kinetic and disruptive operations.

The GRU, as military intelligence, specializes in direct action, military reconnaissance, cyber warfare, and sabotage. Within the GRU, specialized entities such as Unit 29155 have gained global notoriety. Tasked with assassination, subversion, and orchestrating civil unrest across Europe, Unit 29155 operates with a degree of operational independence that frequently bypasses conventional diplomatic sensitivities.

Meanwhile, the FSB—the primary successor to the Soviet-era KGB—manages domestic security, counterintelligence, and cross-border operations targeting dissidents, defectors, and critics. In recent years, the FSB has increasingly outsourced operational tasks to proxy networks, criminal elements, and unwitting local recruits via online messaging platforms, creating a heavily decentralized and deniable mechanism for carrying out sabotage.

Kinetic Sabotage: Weaponizing European Infrastructure

The most profound shift in Russian intelligence doctrine over the past decade is the widespread deployment of kinetic sabotage against Western civilian and military infrastructure. Designed to raise the economic and political costs of Western support for Ukraine while avoiding a direct conventional military response from NATO, these operations target the structural fabric of European daily life.

Intelligence assessments from Western security agencies, including the UK’s MI5, have detailed a sustained mission by Russian operatives to generate chaos on European streets. This campaign has manifested in several destructive forms:

1. Arson and Urban Sabotage: Russian intelligence has increasingly recruited local intermediaries—often radicalized or financially desperate individuals—to set fire to commercial warehouses, logistics hubs, and defense manufacturing plants. Facilities storing military aid destined for Ukraine in the United Kingdom, Poland, Germany, and the Baltic states have repeatedly been targeted by coordinated arson attacks.
2. Transportation Disruptions: Rail networks, which serve dual civilian and military purposes, have experienced mysterious disruptions, cable-cutting incidents, and sabotage attempts in countries like Germany, Poland, and Czechia. Cargo aviation has also been targeted; explosive devices disguised as commercial shipments have been covertly introduced into logistics networks, resulting in fires at freight hubs.
3. Maritime and Undersea Warfare: Critical maritime infrastructure—including undersea fiber-optic communication cables, power grids, and offshore energy pipelines—has faced unprecedented vulnerabilities. Moscow has leveraged its “shadow fleet” of aging commercial vessels, fishing trawlers, and research ships to conduct surreptitious surveillance and physical disruptions, such as deliberate anchor-dragging across strategic Baltic Sea cables.

What makes this wave of sabotage particularly insidious is its deliberate calibration. By keeping individual incidents at a moderate level of destruction and often utilizing deniable proxies, Moscow aims to exploit the threshold of attribution, forcing Western governments to constantly debate whether an incident is an accident, domestic negligence, or state-sponsored terrorism.

Targeted Assassinations and Transnational Repression

While infrastructure sabotage seeks to paralyze logistics, Russian intelligence targets individuals to eliminate perceived threats, silence dissent, and send a chilling deterrent message to defectors. The Kremlin’s willingness to execute high-profile assassinations on foreign soil has repeatedly violated international sovereignty.

Historically, Russian operations relied on specialized poisons and localized coercion, but modern tactics span a spectrum of brazen methods:

• Chemical and Biological Agents: The 2018 use of Novichok—a military-grade nerve agent—in Salisbury, England, to assassinate former GRU officer Sergei Skripal stands as a stark illustration of this brutality. The attack not only exposed civilian populations to extreme danger, resulting in British civilian fatalities, but also laid bare the blatant disregard for foreign territorial integrity.
• Paramilitary Hits on Defectors: High-profile defections are met with swift retribution. When Russian military helicopter pilot Maxim Kuzminov defected to Ukraine, he was subsequently tracked down and assassinated in Spain, serving as a visceral warning to other potential defectors within the Russian armed forces.
• Expanding Horizons of Lethal Targeting: More recently, intelligence revelations have uncovered broader lethal plots extending beyond traditional intelligence targets. Russian operatives have plotted actions against private defense executives—such as attempts against the CEO of German arms manufacturer Rheinmetall—marking a dangerous evolution where individuals contributing to Western defense industrial output are treated as direct combatants.

The Digital Front: Cyber Operations and Disinformation

Kinetic sabotage and physical assassinations do not occur in a vacuum; they are tightly integrated with cyber warfare and psychological operations. Russian intelligence units use cyberespionage to map critical infrastructure, penetrate defense contractor networks, and expropriate sensitive military data.

Concurrently, disinformation campaigns flood the information ecosystem. When a physical sabotage event occurs, Russian state-backed media and network bot farms immediately deploy narratives designed to confuse the public, sow political division within democratic societies, and undermine public confidence in government institutions. The goal is cognitive exhaustion: overwhelming the public with competing conspiracy theories until the truth becomes obscured.

Western Resilience and the Evolving Threat

The relentless tempo of Russian active measures has forced a fundamental transformation in Western security architecture. NATO and European Union member states have established dedicated task forces to protect subsea and critical infrastructure, enhanced intelligence-sharing networks, and expelled hundreds of undeclared Russian intelligence officers operating under diplomatic cover. Furthermore, domestic law enforcement agencies have aggressively pursued and prosecuted local actors recruited for arson and surveillance plots.

However, the brutal reality remains that modern Russian intelligence tactics are designed for a perpetual gray zone—a space between peace and formal war. By weaponizing criminal proxies, exploiting open democratic societies, and maintaining a high tolerance for risk, Moscow’s intelligence agencies continue to pose a persistent, adaptive, and volatile threat to global stability.

About The Author

LAJONG11

See author's posts